nFADP and AI: what a Swiss SME should know before starting

Artificial intelligence opens up many possibilities for SMEs: e-mail sorting, document summaries, voice agents, internal assistants. But as soon as these tools process information about people (clients, patients, staff), data protection comes into play. In Switzerland, the reference framework is the nFADP (new Swiss Federal Act on Data Protection).

This article presents the main points of reference. It does not constitute legal advice: for any decision, we recommend consulting a lawyer or a legal specialist.

The framework: a law in force since 1 September 2023

The nFADP and its implementing ordinance, the Data Protection Ordinance (DPO), entered into force on 1 September 2023. They replace the former 1992 act and bring Swiss law closer to European standards, while keeping their own rules.

The law is worded in a technology-neutral way. It has no chapter specific to AI, but it fully applies to any processing of personal data, including when it goes through an AI model. The Federal Data Protection and Information Commissioner (FDPIC) has pointed this out in its communications.

Principles to follow day to day

Several nFADP principles directly concern AI projects:

• Transparency: people must be informed of the collection of their data and its purpose. In practice, your privacy statement must reflect the tools actually used. When a decision is taken solely by automated means and has significant effects on a person, the law in principle provides for a specific duty to inform.
• Purpose limitation and proportionality: only the data needed for the stated purpose is collected. This is the principle of data minimisation. Before sending a whole document to an AI tool, ask yourself whether all the information it contains is useful.
• Accuracy: the data processed must be correct. A result produced by an AI must be verifiable and correctable.
• Security: the controller must take technical and organisational measures appropriate to the risk: access management, encryption, logging, backups.
• Data protection by design and by default: a tool's default settings must limit processing to what is strictly necessary.

When processing poses a high risk to the people concerned, the law requires a data protection impact assessment to be carried out before the processing.

Records, breaches and processors

Three practical obligations deserve particular attention:

• Record of processing activities: the nFADP in principle requires a record describing the processing carried out. The ordinance provides an exemption for companies with fewer than 250 employees, unless they process sensitive data on a large scale or carry out high-risk profiling. Even when it is not mandatory, a simple record remains a good management tool.
• Breach notification: in the event of a data security breach that is likely to result in a high risk to the people concerned, the controller must notify the FDPIC as soon as possible. The FDPIC provides a notification form on its website.
• Processors: if a service provider (AI tool vendor, hosting provider) processes data on your behalf, a contract must govern this processing, and you remain responsible for ensuring that the provider guarantees data security.

Transferring data abroad

Many AI services run on servers located outside Switzerland. The nFADP regulates these transfers:

• The Federal Council publishes a list of countries that provide an adequate level of protection. Transfers to these countries are in principle possible.
• For other countries, safeguards are required, for example standard contractual clauses recognised by the FDPIC.
• The privacy statement must indicate the countries of destination.

This is one of the reasons why many SMEs prefer, whenever possible, hosting their data in Switzerland. It does not exempt them from their other obligations, but it simplifies the question of transfers.

How we work

At LYL Software, we build these questions into the design of every AI and automation project:

• we identify the personal data concerned with you and limit what is sent to the models;
• we favour hosting in Switzerland (Infomaniak) whenever possible and document any foreign providers;
• we provide for access management, logging and human approval for important decisions;
• we give you the technical information you need for your record and your privacy statement.

We are not lawyers. To validate your compliance, particularly in sensitive sectors such as medical practices or insurance and brokerage, call on a lawyer or a legal specialist. The official websites admin.ch and edoeb.admin.ch also publish useful guides.